This seems like it would be easy. Maybe it is, and I'm being thick today. 😕 Log lines look like ... server1 qs_queue1=50 qs_queue3=60 qs_queue10=100 ... server2 qs_queue4=50 qs_queue6=10 qs_queue10=150 ... server3 qs_queue1=20 qs_queue4=70 qs_queue3=150 I want to create a chart that will list each distinct qs_* field in rows with the sum of all values for that particular qs_ field in the searched time frame listed next to it: qs_queue10 250 qs_queue1 70 qs_queue4 120 ... etc. The chart command ... | chart sum(qs_*) charts in the wrong orientation in 2 rows, with the qs_ fields along the top row, and their values in the 2nd row. Same data being displayed, but in a far less presentable way. TIA, jon ... View more

I'm following the instructions here and can't get it to even recognize the lookup. Did I miss something? My transforms.conf: [SUBJDECODE] external_cmd = utfconv.py Subject fields_list = Subject My props.conf: [source::/syslog/mail/*] LOOKUP_table = SUBJDECODE Subject Any search gives me the error: "The lookup table 'SUBJDECODE' does not exist. It is referenced by configuration 'source::/syslog/mail/*'." I've even verified the lookup exists through the GUI -> Manager -> Lookups -> Lookup Defs SUBJDECODE external No owner system Global | Permissions Enabled .... It appears to recognize the props file, but is not fully integrating the transforms stanza. It shows in the GUI manager but can't be used. Both conf files are in $splunk/etc/system/local, but I've also tried them in the $splunk/etc/apps/search/local dir with equivalent results. ... View more

Receiving splunk server inputs.conf: [splunktcp://7900] Sending splunk server outputs.conf: [tcpout] defaultGroup = rcvr_7900 indexAndForward = false disabled = false [tcpout:rcvr_7900] server = 10.1.2.3:7900 maxQueueSize = 1000 Sending splunk server inputs.conf: [monitor:///var/log/messages] sourcetype = syslog _TCP_ROUTING = tcpout:rcvr_7900 The splunkd.logs show them connecting: 08-17-2010 08:33:25.234 INFO TcpOutputProc - Connected to 10.1.2.3:7900 However, no data has been indexed on rcvr. Both sender and receiver are running 4.1.4. Any tips to track it down? Thanks, Jon ... View more

(Love this forum. Didn't even know about the concurrency command before this morning. 🙂 My search: SYSCODE=ezLMWeb* | transaction EZ_GUID maxspan=60 | concurrency duration=duration All seems well. But how does splunk count concurrent events? My confustion started when I noticed in my results there are 2 events that had concurrency of 18. Shouldn't the number of concurrent events be at least 18? What's the logic behind only 2 events that ran alongside 16 other events at the same time? I'm sure I'm missing something fairly simple. 😕 Thanks, Jon (Doh! No 'concurrency' tag yet.) ... View more

My scheduled search: [Summary Logins Per Second] action.summary_index = 1 action.summary_index._name = lgn-stats cron_schedule = 10 5-17 * * 1-5 dispatch.earliest_time = -15m@m dispatch.latest_time = -5m@m displayview = flashtimeline enableSched = 1 realtime_schedule = 0 request.ui_dispatch_view = flashtimeline search = SYSCODE=LGN-* | sitop _time vsid = gc6frvm6 After running through a few cycles this morning, I ran this search: index=lgn-stats search_name="Summary Logins Per Second" | top _time Our app is particularly busy at the top of the hour. I'm trying to grab the busiest seconds at the top 10 minutes of every hour (X:55:00 - Y:05:00) for monthly reporting. However, the SI search above is returning total events for the entire 10 minutes as the top entries, followed by the top seconds that I really want. Example: time count percent 1 8/2/10 5:55:00.000 AM 55770 inf 2 8/2/10 6:55:00.000 AM 34025 inf 3 8/2/10 4:55:00.000 AM 24479 inf 4 8/2/10 5:56:59.000 AM 155 inf 5 8/2/10 6:00:05.000 AM 144 inf 6 8/2/10 5:58:40.000 AM 137 inf 7 8/2/10 5:59:30.000 AM 136 inf 8 8/2/10 5:58:42.000 AM 134 inf 9 8/2/10 6:00:12.000 AM 131 inf 10 8/2/10 5:59:25.000 AM 128 inf Apparently I've misunderstood something basic about the SI command set. Any tips? Thanks, Jon ... View more

I'm using the forwarder license on my search head. I've disabled all inputs, and any extra apps. Yet I still get license violations. 7.1MB was indexed yesterday, for example. What's the magic to make this stop happening? Splunk 4.1.4 x64 on SuSE Linux. ... View more

2 Splunk 4.1.3 indexers, 1 4.1.3 search head. The search head is connected to the 2 indexers over a T1 that can get busy. Once every couple of days, I can no longer search on one or both of the indexers via the search head. Status in the distributed search management area says "not a splunk server." If I go into the peer, re-enter the username and password, and save it, everything syncs back up and I'm good to go again. However, that's problematic for unattended uses (monitoring scripts, for example). Any solutions? ... View more